How AI agents change exploiting web security weaknesses
The Agent in the Middle: How AI-Mediated Access Reshapes Web Vulnerability Exploitation
Cryptography and SecurityArtificial IntelligenceSoftware Engineering
Summary
Websites now let AI agents perform actions directly through their backend systems instead of users clicking around. This change affects how attackers can exploit security flaws in these websites. The authors built a test set called VELA to check vulnerabilities when AI agents interact with web backends, finding that most vulnerabilities remain exploitable depending mostly on the design of the AI-facing interface. Restricting these interfaces can block some attacks but may also limit normal tasks users want to do. Overall, the interface design matters more for security than the choice of AI agent.
What this means in practice
- •For web security engineers: Assess and improve interface designs to reduce attack risks in AI-mediated web services without disrupting user tasks.
- •For api developers: Design AI-facing APIs with security trade-offs in mind using empirical data from comprehensive vulnerability benchmarks.
Authors
Ruozhao Yang, Jiongchi Yu, Ming Hu, Xiaofei Xie
Abstract
Web services increasingly expose backend interfaces that let users delegate tasks to AI agents, which invoke service operations directly without navigating websites. This shift changes how existing Web vulnerabilities can be exploited. We investigate these changes through VELA, an executable benchmark covering 44 vulnerabilities across twelve Web application families. The benchmark preserves vulnerable backends and derives agent-facing interfaces from legitimate workflows. We evaluate three commercial agents across multiple interface configurations, using controlled comparisons to separate interface effects from agent behavior and independent oracles to verify attack outcomes. Our results show that the agent realizes every attack that direct interface invocation realizes in the reference configuration, so exploitability is set mainly by the interface: 91% of vulnerabilities remain exploitable under the reference design. Interface restrictions prevent some attacks by removing required operations or limiting input control, while retention remains high across vulnerability classes. No case-level loss in the reference configuration is attributed to agent refusal or input normalization, and in one case the agent completed an attack by supplying calls the attacker omitted. Across the tested configurations, interface design affects exploitability more than agent choice, moving retention from 39% to 95% against at most 4.5 points across agents, but some restrictive interfaces also limit legitimate workflows. Our study provides a systematic empirical account of how agent-mediated access reshapes existing Web vulnerabilities, grounding future Web architecture design in measured security outcomes and trade-offs between reducing attack exposure and preserving legitimate functionality in agent-facing services.